Brake control system

ABSTRACT

A brake control system for a motor vehicle comprises a first control device for controlling a first brake actuator, a second control device for controlling a second brake actuator and a third control device for controlling the first and second brake actuator. A switching apparatus is configured to connect the third control device to the first brake actuator and/or to the second brake actuator depending on a fault status of the brake control system.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to German Patent Application No. DE 102019 207 517.7, filed on May 22, 2019 with the German Patent andTrademark Office. The contents of the aforesaid patent application areincorporated herein for all purposes.

TECHNICAL FIELD

The present invention relates to a brake control system for a motorvehicle, comprising a first control device for controlling a first brakeactuator of the motor vehicle and a second control device forcontrolling a second brake actuator of the motor vehicle. The inventionalso relates to a corresponding motor vehicle.

BACKGROUND

This background section is provided for the purpose of generallydescribing the context of the disclosure. Work of the presently namedinventor(s), to the extent the work is described in this backgroundsection, as well as aspects of the description that may not otherwisequalify as prior art at the time of filing, are neither expressly norimpliedly admitted as prior art against the present disclosure.

Known brake control systems for partially automated driving, inparticular in accordance with Level 3 of the SAE-J3016 classification,are designed to be fault-tolerant for a short period of time, such thatthe brake control system remains operational, i.e. “fail-operational”,for approximately 30 seconds in the event of an operationally relevantmalfunction in said system. This time is used, for example, to promptthe driver to take over control and, if they have not done so within 10seconds, for example, to brake the vehicle to a stop in an automatedmanner within 20 seconds, for example.

Known brake control systems of this kind may be designed with singleredundancy. In other words, operationally relevant components of thebrake control system that have not been sufficiently tested in operationand that may potentially be at risk of failing are doubly provided.

In the case of partially automated driving with a higher degree ofautomation or in the case of fully automatic driving, in particular inthe case of driving in accordance with Level 4 or Level 5 of theSAE-J3016 classification, the driver is by definition no longeravailable as backup. For example, the driver is even able to sleepduring a fully automatic journey. Accordingly, in such cases, a brakecontrol system must remain fault-tolerant (“fail-operational”) forsignificantly longer than 30 seconds in order to bring the vehicle intoas safe a state as possible after an operationally relevant malfunction.Due to this requirement, the occurrence of double faults cannot beoverlooked per se, in particular the occurrence of a fault in eachredundant subsystem. Therefore, single redundancy of the brake controlsystem, as provided in known brake control systems, does not offer asufficient level of safety.

Document DE 10 2017 204157 A1 describes a brake regulation system of anelectrohydraulic braking assembly. The brake regulation system comprisesa service brake having at least two hydraulic wheel brakes. A parkingbrake is used as a redundant brake system. The parking brake may beactivated by the same control device as the service brake oralternatively another independent control unit for controlling theparking brake may be used.

In the document DE 10 2013 021871 A1, a motor vehicle having twoseparate redundant brake circuits is described.

SUMMARY

An object of the present invention is to provide an improved brakecontrol system for a motor vehicle that can be operated automatically atleast in part and that improves the fault tolerance of the brake controlsystem.

This object is solved by a brake control system and a motor vehicleaccording to the independent claims. Embodiments of the invention arediscussed in the dependent claims and the following description.

In one exemplary aspect, a brake control system for a motor vehicle isprovided. The brake control system comprises at least a first controldevice for controlling a first brake actuator of the motor vehicle and asecond control device for controlling a second brake actuator of themotor vehicle. The brake control system further comprises a thirdcontrol device for controlling the first brake actuator and the secondbrake actuator, and a switching apparatus, which is configured toconnect the third control device to one or more of the first brakeactuator and to the second brake actuator depending on a fault status ofthe brake control system.

In another exemplary aspect, a motor vehicle comprising a brake controlsystem is provided.

The details of one or more embodiments are set forth in the accompanyingdrawings and the description below. Other features will be apparent fromthe description, drawings, and from the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a block diagram of an exemplary embodiment of a brakecontrol system;

FIG. 2 shows an exemplary embodiment of a motor vehicle; and

FIG. 3 shows a fault case table of another exemplary embodiment of abrake control system.

DETAILED DESCRIPTION

Specific embodiments of the invention are described in detail, below. Inthe following description of embodiments of the invention, the specificdetails are described in order to provide a thorough understanding ofthe invention. However, it will be apparent to one of ordinary skill inthe art that the invention may be practiced without these specificdetails. In other instances, well-known features have not been describedin detail to avoid unnecessarily complicating the instant description.

The improved system is based on the idea of providing an additionalcontrol device and a switching apparatus in addition to two redundantbrake circuits, wherein it is possible for the switching apparatus toconnect the additional control device either to one or both brakeactuators of the two redundant brake circuits depending on a faultstatus of the brake control system.

According to a first independent and exemplary aspect, a brake controlsystem for a motor vehicle is presented, the brake control systemcomprising a first control device for controlling a first brake actuatorof the motor vehicle and a second control device for controlling asecond brake actuator of the motor vehicle. The brake control systemalso comprises a third control device for controlling the first brakeactuator and for controlling the second brake actuator, as well as aswitching apparatus, which is configured to connect the third controldevice to the first brake actuator and/or to the second brake actuatordepending on a fault status of the brake control system.

The brake actuators of the motor vehicle, and if applicable other brakeactuators of the motor vehicle, may be part of the brake control system.Alternatively, the brake actuators may be provided separately to thebrake control system and not be part of the brake control system.

The motor vehicle may in some embodiments be a motor vehicle that can beoperated automatically at least in part. For example, it may be a motorvehicle for partially automatic driving in accordance with Level 3 orLevel 4 of the SAE-J3016 classification or a motor vehicle for fullyautomatic, fully automated or fully autonomous driving as per Level 5 ofthe SAE-J3016 classification.

In some embodiments, the motor vehicle is a motor vehicle according toLevel 4 or Level 5 of the SAE-J3016 classification.

The first control device and the first brake actuator are for examplepart of a first or primary brake circuit. The second brake actuator andthe second control device are for example part of a second or secondarybrake circuit. The primary and the secondary brake circuit are in someembodiments designed to be redundant to one another.

The switching apparatus is in some embodiments configured to connect thethird control device to or isolate, for example galvanically isolate,same from the first brake actuator depending on the fault status. Theswitching apparatus is in some embodiments configured to connect thethird control device to or isolate, in some embodiments galvanicallyisolate, same from the second brake actuator depending on the faultstatus.

If the third control device is connected to one of the brake actuators,the third control device can activate the relevant brake actuator. Ifthe third control device is galvanically isolated from one of the brakeactuators, it is not possible to control the relevant brake actuator bymeans of the third control device.

In some embodiments, the brake control system, for example one of thecontrol devices, is configured to control the switching apparatus inorder to connect or isolate the third control device to or from thefirst and/or second brake actuator.

The brake control system may also be referred to as a brake regulationsystem, e.g., a closed-loop control system.

By providing the third control device and the switching apparatus,double redundancy of the brake control system may be effectivelyachieved. Single redundancy is in some embodiments achieved by means ofthe first and second control device together with the first and secondbrake actuator, i.e., by means of the primary and secondary brakecircuit. In the event of an operationally relevant fault of the brakeregulation system or brake control system, the third control device maybe used to control the first and/or second brake actuator, as a resultof which a second redundancy level is implemented. This way, the brakecontrol system can remain operational even in the event of twooperationally relevant malfunctions or faults in various brake circuits,and therefore the brake control system can be considered to befault-tolerant (in the following also referred to as “fail-operational”)for longer periods of time. This is due to the fact that the probabilityof a triple fault, which relates both to the primary and to thesecondary brake circuit and to the third control device or the switchingapparatus, is far lower than for a double fault and far, far lower thana single fault.

“Fault-tolerant” or “fail-operational” can be understood to mean thatthe brake control system continues to function in the event of a fault.Therefore, the brake control system remains operational.

By improving the fault tolerance, in some embodiments by means of thelonger times for which fail-operational use of the brake control systemcan be assumed, the brake control system can also be used for partiallyor fully automated motor vehicles in which a driver is no longeravailable as a potential backup in the event of an operationallyrelevant fault. In some embodiments, the brake control system can alsobe used for partially automated motor vehicles as per Level 4 of theSAE-J3016 classification and for fully automated motor vehicles as perLevel 5 of the SAE-J3016 classification.

In addition, in contrast with a system designed with single redundancy,the improved system does not require additional brake actuators to beprovided, which results in low complexity, little installation space andlow cost of the brake control system.

The brake actuators may for example each comprise a brake booster.Additionally, the brake actuators may for example each comprise a driveunit, for example a hydraulic, pneumatic, electronic or electric driveunit, in order to be able to actuate a brake assigned to the relevantbrake actuator, in particular activated by the relevant control deviceprovided for control purposes.

According to some embodiments of the brake control system, the first andsecond brake actuator each serve to actuate an associated parking brakeof the motor vehicle.

According to some embodiments of the brake control system, the firstcontrol device can be or is connected to a first on-board power supplyof the motor vehicle in order to supply power to the first controldevice. The second control device can be or is connected to a secondon-board power supply of the motor vehicle in order to supply power tothe second control device. The third control device can be or isconnected to the first on-board power supply and to the second on-boardpower supply, for example can be or is simultaneously or optionallyconnected to the first and second on-board power supply, in order tosupply power to the third control device.

For example, the first brake actuator can be or is connected to thefirst on-board power supply in order to supply power to the first brakeactuator, and the second brake actuator can be or is connected to thesecond on-board power supply in order to supply power to the secondbrake actuator.

An on-board power supply may in some embodiments be an energy or voltagesupply of the motor vehicle.

The first and the second on-board power supply are in some embodimentsdesigned to be redundant to one another.

By designing the on-board power supplies to be redundant, the brakecontrol system can remain fail-operational even in the event of anoperationally relevant malfunction or fault in one of the on-board powersupplies.

In some embodiments, the third control device can be or is connected toboth on-board power supplies, such that the functioning of the thirdcontrol device is not impaired by failure of one of the two on-boardpower supplies.

According to some embodiments, the brake control system at leastpartially includes the first and second on-board power supply.

According to some embodiments, the third control device can be connectedto a third on-board power supply of the motor vehicle in order to supplypower to the third control device.

The third control device may be connectable to the third on-board powersupply as an alternative or in addition to being connected to the firstand second on-board power supply.

By providing the third on-board power supply, provision is made for thesimultaneous failure of the first and second on-board power supply, andtherefore the brake control system can remain fail-operational in thiscase as well.

In some embodiments, the third on-board power supply is designed to beredundant to the first and second on-board power supply.

According to some embodiments, the brake control system at leastpartially includes the third on-board power supply.

According to some embodiments, the first control device can be or isconnected to another first brake actuator of the motor vehicle and isconfigured to control the other first brake actuator, for example if itis connected thereto.

According to some embodiments, the second control device can be or isconnected to another second brake actuator of the motor vehicle and isconfigured to control the other second brake actuator, for example if itis connected thereto.

In some embodiments, the first control device may be connectable orconnected to the first other brake actuator and/or the second controldevice may be connectable or connected to the second other brakeactuator such that the connection exists in each case independently ofthe switching apparatus and in particular in each case independently ofthe fault status of the motor vehicle.

The other brake actuators may in some embodiments be brake actuators foractuating respectively assigned service brakes of the motor vehicle.

Therefore, the first control device can activate the first brakeactuator and/or the first other brake actuator, the second controldevice can activate the second brake actuator and/or the second otherbrake actuator, and the third control device can activate the first andthe second brake actuator.

As a result, all single faults of the brake control system can beprovided for, as can all variants of double faults. A double fault canin some embodiments be understood to mean a fault in which twooperationally relevant malfunctions or faults of different components,for example of the control devices, the brake actuators, the other brakeactuators and the on-board power supplies, occur. Exempt from this arefault situations in which the first and second on-board power supplyfail at the same time and in which the third on-board power supply isnot provided.

According to some embodiments, the switching apparatus is configured toconnect the first control device to the first brake actuator or toisolate, e.g., galvanically isolate, the first control device from thefirst brake actuator depending on the fault status.

According to some embodiments, the switching apparatus is configured toconnect the second control device to the second brake actuator or toisolate, e.g., galvanically isolate, the second control device from thesecond brake actuator depending on the fault status.

In some embodiments, the switching apparatus is configured to isolatethe first control device from the first brake actuator if the thirdcontrol device is connected to the first brake actuator and to isolatethe third control device from the first brake actuator if the firstcontrol device is connected to the first brake actuator. Moreover, theswitching apparatus is for example configured to isolate the secondcontrol device from the second brake actuator if the third controldevice is connected to the second brake actuator and to isolate thethird control device from the second brake actuator if the secondcontrol device is connected to the second brake actuator.

According to some embodiments, the switching apparatus comprises a firstswitching element for connecting the first control device to the firstbrake actuator and for isolating, e.g., galvanically isolating, thefirst control device from the first brake actuator.

In some embodiments, the first switching element is connected to thefirst control device and can be or is connected to the first brakeactuator, such that the first switching element is or can be arrangedbetween the first control device and the first brake actuator.

According to some embodiments, the switching apparatus comprises asecond switching element for connecting the third control device to thefirst brake actuator and for isolating, e.g., galvanically isolating,the third control device from the first brake actuator.

In some embodiments, the second switching element is connected to thethird control device and can be or is connected to the first brakeactuator, such that the second switching element is or can be arrangedbetween the third control device and the first brake actuator.

According to some embodiments, the switching apparatus comprises a thirdswitching element for connecting the third control device to the secondbrake actuator and for isolating, e.g., galvanically isolating, thethird control device from the second brake actuator.

In some embodiments, the third switching element is connected to thethird control device and can be or is connected to the second brakeactuator, such that the third switching element is or can be arrangedbetween the third control device and the second brake actuator.

According to some embodiments, the switching apparatus comprises afourth switching element for connecting the second control device to thesecond brake actuator and for isolating, e.g., galvanically isolating,the second control device from the second brake actuator.

In some embodiments, the fourth switching element is connected to thesecond control device and can be or is connected to the second brakeactuator, such that the fourth switching element is or can be arrangedbetween the second control device and the second brake actuator.

According to some embodiments, the first control device, the secondcontrol device or the third control device are designed as a switchingcontrol device or the brake control systems comprises a fourth controldevice, which is designed as a switching control device. The switchingcontrol device is coupled or connected to the switching apparatus and isconfigured to control the switching apparatus, for example the switchingelements, depending on the fault status, e.g., to open or close theswitching elements in order to connect the third control device to thefirst brake actuator and/or the second brake actuator or to isolate thethird control device from the first brake actuator and/or the secondbrake actuator.

The switching control device is in some embodiments also configured tocontrol the switching apparatus in order to connect the first controldevice to or to isolate same from the first brake actuator and isconfigured to connect the second control device to or to isolate samefrom the second brake actuator.

A benefit of the embodiments of the third control device or fourthcontrol device as a switching control device is that the first or secondswitching control device of a system that is for example already presentdoes not have to be specifically adapted in order to control theswitching apparatus. In the embodiments of the third control device as aswitching control device, there is also the advantage that the fourthcontrol device is not needed.

According to some embodiments, the first control device is or can beconnected to a data transmission system of the motor vehicle in order toreceive control commands for controlling the first brake actuator and/orfor controlling the first other brake actuator.

According to some embodiments, the second control device is or can beconnected to the data transmission system in order to receive controlcommands for controlling the second brake actuator and/or the secondother brake actuator.

According to some embodiments, the third control device is or can beconnected to the data transmission system in order to receive controlcommands for controlling the first brake actuator and/or the secondbrake actuator.

According to some embodiments, the switching control device is or can beconnected to the data transmission system in order to receive a faultsignal that depends on the fault status of the motor vehicle.

The fault signal in some embodiments uniquely defines the fault statusof the motor vehicle or of the brake control system.

The data transmission system may for example be designed as a data bussystem, for example as a field bus system, in particular as a CAN bussystem.

According to some embodiments, the brake control system at leastpartially comprises the data transmission system.

The data transmission system may for example be connected to a centralcontrol unit or to another control device of the motor vehicle in orderto receive control commands.

The central control unit may for example also provide the fault signal.Alternatively, the fault signal or respective components of the controlsignal may be provided by the first and/or second control device.

According to some embodiments, the brake control system includes thefirst and second brake actuator. The first control device and the thirdcontrol device are each connected to the first brake actuator via theswitching apparatus, e.g., the first control device is connected via thefirst switching element and the third control device is connected viathe second switching element. The second control device and the thirdcontrol device are each connected to the second brake actuator via theswitching apparatus, e.g., the third control device is connected via thethird switching element and the second control device is connected viathe fourth switching element.

The switching apparatus, or rather the switching elements, are thereforearranged between the relevant control device and the relevant brakeactuator.

According to some embodiments, the control device is connected to thefirst other brake actuator and the second control device is connected tothe second other brake actuator.

According to another independent and exemplary aspect, a motor vehiclecomprising a brake control system according to the first exemplaryaspect or one or more of its embodiments is provided.

The motor vehicle may for example be operated in a partially or fullyautomatic manner and in particular equates to a motor vehicle accordingto Level 4 or Level 5 of the SAE-J3016 classification.

The present discussion also includes combinations of the features of thedescribed embodiments.

Reference will now be made to the drawings in which the various elementsof embodiments will be given numerical designations and in which furtherembodiments will be discussed.

Specific references to components, process steps, and other elements arenot intended to be limiting. Further, it is understood that like partsbear the same or similar reference numerals when referring to alternateFIGS. It is further noted that the FIGS. are schematic and provided forguidance to the skilled reader and are not necessarily drawn to scale.Rather, the various drawing scales, aspect ratios, and numbers ofcomponents shown in the figures may be purposely distorted to makecertain features or relationships easier to understand.

In the exemplary embodiments described herein, the described componentsof the embodiments each represent individual features of the inventionthat should be considered independent of one another, and shouldtherefore be considered as a part of the invention both individually orin another combination other than that shown. In addition, the describedembodiments can also be supplemented by other features of the inventionthan those already described.

FIG. 1 shows an exemplary embodiment of a brake control system BS.

The brake control system BS comprises a first brake actuator B1, whichis connected to a first on-board power supply BN1 of a motor vehicle Kin order to be supplied with power. The brake control system BS alsocomprises a first control device SG1, which is also connected to thefirst on-board power supply BN1 in order to be supplied with power andwhich is connected to a data bus D of the motor vehicle K. The brakecontrol system BS also comprises a switching apparatus SE, whichincludes a first switch S1. The first control device SG1 can beconnected to the first brake actuator B1 via the first switch S1.

The brake control system BS also comprises a second brake actuator B2,which is connected to a second on-board power supply BN2 of the motorvehicle K in order to be supplied with power. The brake control systemBS comprises a second control device SG2, which is connected to thesecond on-board power supply BN2 in order to be supplied with power.Moreover, the second control device SG2 is connected to the data bus D.The switching apparatus SE comprises a fourth switch S4, via which thesecond control device SG2 can be connected to the second brake actuatorB2.

The brake control system BS also comprises a third control device SG3,which is connected to both the first on-board power supply BN1 and tothe second on-board power supply BN2 in order to be supplied with power.The on-board power supplies BN1, BN2 may each serve as the power supplyfor the third control device SG3 independently of one another. Theswitching apparatus SE comprises a second switch S2, by means of whichthe third control device SG3 can be connected to the first brakeactuator B1, and a third switch S3, by means of which the third controldevice SG3 can be connected to the second brake actuator B2.

The brake control system BS may for example comprise another first brakeactuator A1, which is connected to the first on-board power supply BN1in order to be supplied with power and which is connected to the firstcontrol device SG1. Moreover, the brake control system BS may comprise asecond other brake actuator A2, which is connected to the secondon-board power supply BN2 in order to be supplied with power and whichis connected to the second control device SG2.

Optionally, the motor vehicle K may comprise a third on-board powersupply BN3, which may be connected to the third control device SG3 inorder to supply power thereto. Power may be supplied to the thirdcontrol device SG3 via the third on-board power supply BN3 as analternative or in addition to the power supply via the first and/orsecond on-board power supply BN1, BN2. For example, the first and thesecond brake actuator B1, B2 may be connected to the third on-boardpower supply BN3 in order to be supplied with power, in particular inaddition to the power supply via the first on-board power supply BN1 andsecond on-board power supply BN2, respectively.

FIG. 2 schematically shows an exemplary embodiment of a motor vehicle K.The motor vehicle K comprises a brake control system BS as describedherein, for example a brake control system BS as shown in FIG. 1 and asdescribed with reference to FIG. 1.

In the example in FIG. 2, the brake actuators B1, B2 may for example bebrake actuators for parking brakes of the motor vehicle K and may forexample be arranged on rear wheels of the motor vehicle K. The otherbrake actuators A1, A2 may for example be brake actuators for servicebrakes of the motor vehicle K and may for example be arranged on frontwheels of the motor vehicle K.

Again referring to FIG. 1, the third control device SG3 may for examplebe connected to the switches S1, S2, S3, S4 of the switching apparatusSE in order to control said switches, in particular to either open orclose same. The third control device SG3 may for example receive a faultsignal via the data bus D, for example from a central control unit ofthe motor vehicle K and/or from the control devices SG1, SG2, the faultsignal containing information about a fault status of the brake controlsystem BS. In particular, the third control device SG3 may determine,based on the fault signal, whether a fault or malfunction, in particularan operationally relevant fault or malfunction, in one of the controldevices SG1, SG2, SG3, one of the brake actuators A1, A2, B1, B2, and/orone of the on-board power supplies BN1 or BN2 has occurred.

Depending on the fault signal and the corresponding fault status of thebrake control system BS, the third control device SG3 can connect thecontrol devices SG1, SG2, SG3 to or galvanically isolate same from thebrake actuators B1, B2 in a targeted manner in order to ensure theoperational readiness of the brake control system BS, even in the eventof faults in the above-mentioned components of the brake control systemBS.

Subject to any malfunctions, the first control unit SG1 can activate thefirst other brake actuator A1 and, in particular if the first switch S1is closed, the first brake actuator B1. The second control device SG2can, subject to any malfunctions, activate the second other brakeactuator A2 and, in particular if the fourth switch S4 is closed, thesecond brake actuator B2. The third control device can activate thefirst brake actuator B1 when the second switch S2 is closed and thesecond brake actuator B2 when the third switch S3 is closed.

The brake actuators B1, B2 may for example be configured to achieve adeceleration of the motor vehicle K of 2.44 m/s² or more. The otherbrake actuators A1, A2 are for example configured to also produce adeceleration of the motor vehicle K of at least 2.44 m/s². For example,the other brake actuators A1, A2 are configured to achieve adeceleration of the motor vehicle K of at least 6.45 m/s².

By virtue of the various options for connecting the control devices SG1,SG2 and SG3 to the first brake actuator B1 and/or second brake actuatorB2 via the switching apparatus SE, effective actuation of at least oneof the brake actuators A1, A2, B1, B2 remains possible in the event offailure of up to two of the control devices SG1, SG2, SG3, brakeactuators A1, A2, B1, B2 and on-board power supplies BN1, BN2, with theexception of simultaneous failure of both on-board power supplies BN1,BN2. Because each of the brake actuators A1, A2, B1, B2 can achieve arequired or, for example, prescribed minimum deceleration, for example2.44 m/s², in the event of each of the described fault cases thisspecification can be met and the brake control system BS can remainfail-operational.

FIG. 3 shows a fault table which lists various fault statuses or faultcases of a brake control system BS as shown for example in FIG. 1. Theoptional third on-board power supply BN3, for example, is not providedhere. The first column of the table shows a serial number of the faultstatus. The second column corresponds to a status of the first controldevice SG1, the third column to a status of the first other brakeactuator A1, the fourth column to a status of the first brake actuatorB1 and the fifth column to a status of the first on-board power supplyBN1. The sixth column corresponds to a status of the second controldevice SG2, the seventh column corresponds to a status of the secondother brake actuator A2, the eighth column corresponds to a status ofthe second brake actuator B2 and the ninth column corresponds to astatus of the second on-board power supply BN2. The tenth columncorresponds to a status of the third control device SG3. The eleventhcolumn corresponds to a switching state of the first switch S1, thetwelfth column corresponds to a switching state of the second switch S2,the thirteenth column corresponds to a switching state of the thirdswitch S3 and the fourteenth column corresponds to a switching state ofthe fourth switch S4.

A switching state of a switch S1, S2, S3, S4 that corresponds to an openswitch is denoted by 0 and a switching state that corresponds to aclosed switch is indicated by 1. A cross (“x”) against one of thecomponents means that an operationally relevant malfunction of therelevant component has occurred. If no cross is present, nooperationally relevant malfunction of the relevant component hasoccurred. A check “✓” against one of the components means that therelevant component can be used to provide a braking effect for the motorvehicle K in the corresponding fault scenario.

A situation in which a simultaneous fault in both on-board powersupplies BN1 and BN2 has occurred is not considered here. In the case ofrobust on-board power supplies, it can be assumed that such faults arehighly unlikely and negligible for corresponding use cases. Inparticular, in the event of a malfunction in one of the control devicesSG1, SG2, SG3 or one of the brake actuators B1, B2, the switch S1, S2,S3, S4 which is connected to the relevant component is opened such thatthe corresponding control device SG1, SG2, SG3 is galvanically isolatedfrom the corresponding brake actuator B1, B2.

The 35 fault statuses shown in FIG. 3 may for example be split into ninegroups. These individual groups differ in each case in terms of thecomponents which achieve the required braking effect in the event of afault as well as in terms of the associated switch positions. By way ofclarification, the first control device SG1, the first on-board powersupply BN1 and the first and other first brake actuators B1, A1 areassigned to a primary brake circuit and the second control device SG2,the second on-board power supply BN2, the second brake actuator B2 andthe second other brake actuator A2 are assigned to a secondary brakecircuit.

Moreover, it is assumed in the following, without loss of generality,that each of the brake actuators B1, B2 can achieve a brakingdeceleration of 2.44 m/s² or more and each of the other brake actuatorsA1, A2 can achieve a braking deceleration of 6.45 m/s² or more.

The fault cases 1 to 10 can be ascribed to a first group. The featurecommon to all these fault cases is that operationally relevant faultshave occurred in two components of the secondary brake circuit.Accordingly, the third control unit SG3 is configured to close the firstswitch S1 and open the remaining switches S2, S3, S4. The first controldevice SG1 can activate the first brake actuator B1 and the other firstbrake actuator A1 such that the secondary brake circuit can produce abraking deceleration of at least 6.45 m/s²+2.44 m/s²=8.89 m/s².

The fault cases 11 to 20 can be ascribed to a second group. The featurecommon to the fault cases of the second group is that two operationallyrelevant malfunctions or faults have occurred in different components ofthe primary brake circuit. Accordingly, the third control unit SG3 isconfigured to close the fourth switch S4 and open the remaining switchesS1, S2, S3. The second control device SG2 can activate the second brakeactuator B2 and the other second brake actuator A2 such that thesecondary brake circuit can produce a minimum braking deceleration of8.89 m/s².

The fault cases 21 to 24 can be assigned to a third group, in which thefirst control device SG1 or the first other brake actuator A1 in theprimary brake circuit and the second control device 2 or the secondother brake actuator A2 in the secondary brake circuit have experiencedan operationally relevant fault.

The third control device SG3 is accordingly configured to close thesecond switch S2 and the third switch S3 and to open the first switch S1and the fourth switch S4. Consequently, the third control device canactivate the first and second brake actuator B1, B2 and thus achieve aminimum braking deceleration of 2×2.44 m/s²=4.88 m/s².

The fault cases 25 and 26 can be assigned to a fourth group, in whichthe second brake actuator B2 in the secondary brake circuit and eitherthe first control device SG1 or the first other brake actuator A1 in theprimary brake circuit have experienced an operationally relevantmalfunction. Accordingly, the third control device SG3 is configured toclose the second switch S2 and open the remaining switches S1, S3, S4.The second control device SG3 can accordingly activate the other secondbrake actuator A2 and the third control device SG3 can activate thefirst brake actuator B1 such that a total minimum braking decelerationof 8.89 m/s² can be achieved.

The fault cases 27 and 28 can be assigned to a fifth group, in which thefirst brake actuator B1 in the primary brake circuit and either thesecond control device SG2 or the second other brake actuator A2 in thesecondary brake circuit have experienced an operationally relevantmalfunction. Accordingly, the third control device SG3 is configured toclose the third switch S3 and open the remaining switches S1, S2, S4. Asa result, the first control device can activate the first other brakeactuator A1 and the third control device SG3 can activate the secondbrake actuator B2, and therefore a minimum braking deceleration of 8.89m/s² can be achieved.

The fault cases 29 and 30 can be assigned to a sixth group, in which thefirst brake actuator B1 in the primary brake circuit and either thesecond brake actuator B2 or the second on-board power supply BN2 in thesecondary brake circuit have experienced an operationally relevantmalfunction. Accordingly, the third control device SG3 is configured toopen all four switches S1, S2, S3, S4. The first control device SG1 isthen in a position to activate the first other brake actuator A1 inorder to achieve a minimum braking deceleration of 6.45 m/s².

The fault case 31 corresponds to a seventh group, in which anoperationally relevant malfunction has occurred in the first on-boardpower supply BN1 in the primary brake circuit and an operationallyrelevant malfunction has occurred in the second brake actuator B2 in thesecond brake circuit. Accordingly, the third control device SG3 isconfigured to open all four switches S1, S2, S3, S4 here as well. Inthis case, the second control device SG2 can activate the second otherbrake actuator A2 such that a minimum braking deceleration of 6.45 m/s²can be achieved.

The fault cases 32 and 33 can be assigned to an eighth group, in whichthe first control device SG1 or the first other brake actuator A1 in theprimary brake circuit and the second on-board power supply BN2 in thesecondary brake circuit have experienced an operationally relevantmalfunction. In this case, the third control device SG3 is configured toclose the second switch S2 and open the remaining switches S1, S3, S4.As a result, the third control device SG3 can activate the first brakeactuator B1 such that a minimum braking deceleration of 2.44 m/s² can beachieved.

The fault cases 34 and 35 can be assigned to a ninth group, in which anoperationally relevant malfunction has occurred in the first on-boardpower supply BN1 in the primary brake circuit and an operationallyrelevant malfunction has occurred either in the second control deviceSG2 or in one of the second other brake actuators A2 in the secondarybrake circuit. Accordingly, the third control device SG3 is configuredto close the third switch S3 and open the remaining switches S1, S2, S4.As a result, the third control device SG3 can activate the second brakeactuator B2 in order to again achieve a minimum braking deceleration of2.44 m/s².

By way of example, some fault cases shall be considered individually. Inthe fault case 21, the first control device SG1 and the second controldevice SG2, for example, fail at the same time, which is detected by thethird control device SG3 by means of the fault signal. The third controldevice SG3 then opens the first switch S1 and the fourth switch S4 andcloses the second switch S2 and the third switch S3, as a result ofwhich the third control device SG3 is galvanically isolated from theremaining control devices SG1 and SG2 and can now activate the brakeactuators B1 and B2. The same applies to a simultaneous failure of thesecond control device SG2 and the first other brake actuator A1 in faultcase 22, and to a simultaneous failure of the first other brake actuatorA1 and the second other brake actuator A2 in fault case 24.

If, for example, the first brake actuator B1 in the primary brakecircuit and the second control device SG2 or the second on-board powersupply BN2 in the secondary brake circuit fail, as in the fault cases 27and 30, the braking effect can be produced via the third control deviceSG3 and second brake actuator B2 alone. For this purpose, the thirdswitch S3 is closed and the first, second and fourth switch S1, S2, S4are opened.

In particular, in the fault cases 1 to 31, a minimum deceleration ofgreater than 2.44 m/s² is achieved. In the fault cases 32 and 33, inwhich a fault has occurred in the first control device SG1 or firstother brake actuator A2 in the primary brake circuit and a fault hasoccurred in the second on-board power supply BN2 in the secondary brakecircuit, the minimum deceleration of 2.44 m/s² is also achieved. Thesame applies to fault cases 34 and 35.

According to the teachings herein, a fault tolerance of a brake controlsystem is improved by increasing a time for which fail-operational usecan be ensured. In particular, according to the teachings herein, costcan be saved by enhancing a solution for upgrading existing brakecontrol systems designed for driving according to Level 3 of theSAE-J3016 classification to Level 4 or Level 5.

In numerous embodiments, the primary and secondary brake circuits do notrequire hardware updates, which can also result in cost savings duringdevelopment and manufacture of the brake control system. By using anadditional control device and the switching apparatus, the complexityand installation space of the system can be reduced.

LIST OF REFERENCE NUMBERS

-   SG1, SG2, SG3 Control devices-   A1, A2, B1, B2 Brake actuators-   SE Switching apparatus-   S1, S2, S3, S4 Switching elements-   BS Brake control system-   D Data transmission system-   BN1, BN2, BN3 On-board power supplies-   K Motor vehicle

The invention has been described in the preceding using variousexemplary embodiments. Other variations to the disclosed embodiments canbe understood and effected by those skilled in the art in practicing theclaimed invention, from a study of the drawings, the disclosure, and theappended claims. In the claims, the word “comprising” does not excludeother elements or steps, and the indefinite article “a” or “an” does notexclude a plurality. A single processor, module or other unit or devicemay fulfil the functions of several items recited in the claims.

The mere fact that certain measures are recited in mutually differentdependent claims or embodiments does not indicate that a combination ofthese measures cannot be used to advantage. Any reference signs in theclaims should not be construed as limiting the scope.

What is claimed is:
 1. A brake control system for a road vehicle,comprising: a first control device for controlling a first brakeactuator of the road vehicle; a second control device for controlling asecond brake actuator of the road vehicle, wherein the second controldevice does not control the first brake actuator and the first controldevice does not control the second brake actuator; a third controldevice for controlling the first brake actuator and the second brakeactuator; and an electric switching apparatus, which is configured toselectively connect the third control device to one or more of the firstbrake actuator and to the second brake actuator depending on a faultstatus of the brake control system; wherein the switching apparatus isfurther configured, depending on the fault status, to one or more of:galvanically disconnect the first control device from the first brakeactuator, and galvanically disconnect the second control device from thesecond brake actuator.
 2. The brake control system of claim 1, whereinthe first control device can be connected to a first on-board powersupply of the road vehicle in order to be supplied with power; thesecond control device can be connected to a second on-board power supplyof the road vehicle in order to be supplied with power; and the thirdcontrol device can be connected to the first and second on-board powersupply in order to be supplied with power.
 3. The brake control systemof claim 2, wherein the third control device can be connected to a thirdon-board power supply of the road vehicle in order to be supplied withpower.
 4. The brake control system of claim 2, wherein the first controldevice can be connected to another first brake actuator of the roadvehicle and is configured to control the other first brake actuator;and/or the second control device can be connected to another secondbrake actuator of the road vehicle and is configured to control theother second brake actuator.
 5. The brake control system of claim 2,wherein the switching apparatus is configured to connect the firstcontrol device to the first brake actuator depending on the faultstatus; and/or the switching apparatus is configured to connect thesecond control device to the second brake actuator depending on thefault status.
 6. The brake control system of claim 1, wherein the thirdcontrol device can be connected to a third on-board power supply of theroad vehicle in order to be supplied with power.
 7. The brake controlsystem of claim 6, wherein the first control device can be connected toanother first brake actuator of the road vehicle and is configured tocontrol the other first brake actuator; and/or the second control devicecan be connected to another second brake actuator of the road vehicleand is configured to control the other second brake actuator.
 8. Thebrake control system of claim 6, wherein the switching apparatus isconfigured to connect the first control device to the first brakeactuator depending on the fault status; and/or the switching apparatusis configured to connect the second control device to the second brakeactuator depending on the fault status.
 9. The brake control system ofclaim 1, wherein the first control device can be connected to anotherfirst brake actuator of the road vehicle and is configured to controlthe other first brake actuator; and/or the second control device can beconnected to another second brake actuator of the road vehicle and isconfigured to control the other second brake actuator.
 10. The brakecontrol system of claim 9, wherein the switching apparatus is configuredto connect the first control device to the first brake actuatordepending on the fault status; and/or the switching apparatus isconfigured to connect the second control device to the second brakeactuator depending on the fault status.
 11. The brake control system ofclaim 1, wherein the electric switching apparatus is configured toselectively connect the first control device to the first brake actuatordepending on the fault status; and/or the electric switching apparatusis configured to selectively connect the second control device to thesecond brake actuator depending on the fault status.
 12. The brakecontrol system of claim 11, wherein the electric switching apparatuscomprises: a first switching element for selectively connecting thefirst control device to the first brake actuator; a second switchingelement for selectively connecting the third control device to the firstbrake actuator; a third switching element for selectively connecting thethird control device to the second brake actuator; and a fourthswitching element for selectively connecting the second control deviceto the second brake actuator.
 13. The brake control system of claim 1,wherein the first control device, the second control device, and thethird control device can be connected to a data transmission system ofthe road vehicle in order to receive control commands for controllingone or more of the first and second brake actuator.
 14. The brakecontrol system of claim 1, wherein the brake control system comprisesthe first and second brake actuator; the first control device and thethird control device are each connected to the first brake actuator viathe switching apparatus; and the second control device and the thirdcontrol device are each connected to the second brake actuator via theswitching apparatus.
 15. A road vehicle comprising a brake controlsystem with: a first control device for controlling a first brakeactuator of the road vehicle; a second control device for controlling asecond brake actuator of the road vehicle, wherein the second controldevice does not control the first brake actuator and the first controldevice does not control the second brake actuator; a third controldevice for controlling the first brake actuator and the second brakeactuator; and an electric switching apparatus, which is configured toselectively connect the third control device to one or more of the firstbrake actuator and to the second brake actuator depending on a faultstatus of the brake control system; wherein the switching apparatus isfurther configured, depending on the fault status, to one or more of:galvanically disconnect the first control device from the first brakeactuator, and galvanically disconnect the second control device from thesecond brake actuator.